Concentrated Liquidity and Security Problems (2024)

This article discusses Concentrated Liquidity implemented by Uniswap and potential security issues that may arise from it.

The DeFi ecosystem has consistently invested efforts to create an efficient exchange where both makers and takers can share the profits in smart contracts. While the order book model widely used in traditional financial markets could solve this problem easily, it could not be easily adopted due to the unique characteristics of blockchain. In order book exchanges, when a maker sets the price and amount, takers can execute the final transaction as much as they want. The order book model, in which makers have to place and cancel orders from dozens to hundreds of times per second, is almost impossible to implement on a blockchain with long block generation times.

Automated Market Maker (AMM) simplified the makers’ actions. When the maker supplies multiple tokens to a single liquidity pool, the current value and exchange rate of the tokens are automatically calculated based on the current balance. Takers can proceed with the transaction according to the current exchange rate without interacting with the maker. Comparing the order book and AMM, the following can be observed:

There are two major drawbacks to the AMM method: slippage and Impermanent Loss (IL). In most AMMs, the expected value and exchange ratio automatically change based on the remaining amount of the reserve tokens. Therefore, if a taker performs a large trade at once, the exchange ratio becomes more unfavorable than originally expected, resulting in losses. This is known as increased slippage.

IL occurs because makers engage in actions that oppose takers without a separate order. After makers provide liquidity to the pool the composition ratio of tokens fluctuates depending on taker orders. As a result, they end up owning more of the asset decreasing in price and less of the asset increasing in price. Therefore, they are more vulnerable to price volatility than if they had yet to provide liquidity.

AMMs are categorized based on their invariant formula, We will discuss the simple ones first.

Constant Sum Market Maker (CSMM) maintains a constant sum of the quantities of tokens. This can be expressed as x + y = k. The exchange ratio of the two tokens stays the same; therefore, if the price equilibrium is not maintained, one of the assets eventually leaks out.

Constant Product Market Maker (CPMM) maintains a constant product of the quantities of tokens. This can be expressed as x * y = k. As one side’s quantity decreases, the relative value increases rapidly, and the price diverges to infinity. Although it was widely used in early AMMs because takers could always make a rational exchange ratio in either direction, it bears the risks of slippage and IL mentioned above.

CPMM is simple and powerful, but it has the disadvantage of wasting liquidity to ensure that exchanges can take place until the exchange ratio of assets becomes infinite. This is evident when exchanging stable coins that aim to maintain a certain value.

There are various compromises to solve this problem, and one of them is shown by Curve Finance’s Stable Swap. When the difference in the quantity of assets is not large, it operates closer to the CSMM to minimize slippage; if there is a large price difference, it transitions to something similar to the CPMM to avoid asset drainage.

Concentrated liquidity is a liquidity supply method that concentrates liquidity in a specific price range. It was introduced by Uniswap Labs two years ago. When supplying liquidity, you can set the price range. However, you only receive fees for swaps that occur within that price range.

In CPMM, the liquidity supplied by the maker affects the current price, regardless of the relationship between the two assets. However, now that there is liquidity supplied only within a specific price range, the size of available liquidity varies for each of the fixed intervals the price range is divided into, also known as ticks. Makers concentrate liquidity on the areas where it is expected that there will be a lot of trading by takers, which is mainly around the current price, in order to receive fees generated from trading in that area. These benefits takers who trade at the current price, since slippage occurs less frequently in areas where liquidity is abundant.

Uniswap V3, Trident Concentrated liquidity pool, and other platforms have implemented concentrated liquidity.

The above image shows that liquidity for stablecoins DAI and USDC is almost exclusively concentrated around the exchange rate of 1.

In the case of USDC and ETH, liquidity is much more evenly spread, although the bulk of the liquidity supply is distributed around the current price.

An alternative to the aforementioned centralized liquidity provision is Just-In-Time (JIT) liquidity.

Just-in-time (JIT) Liquidity

Just-In-Time (JIT) liquidity is one of the strategies to amplify Maximal Extractable Value (MEV) and achieve maximum profit efficiency. This can have the effect of increasing the cost of price manipulation by providing liquidity efficiently.

JIT liquidity corresponds to Miner Extractable Value (MEV), where MEV is the maximum gain a miner can get from the act of looking ahead and reordering transactions.

JIT liquidity is a strategy of supplying liquidity just before taker orders and retracting it immediately after. Liquidity is supplied within a very small price range. In general, existing Liquidity Providers (LPs) supply liquidity over a wide range based on the current price, so if we only consider the price at which the current transaction is occurring, they have supplied relatively little liquidity in the price interval. Therefore, JIT liquidity providers have a large stake in the fees generated by the taker orders targeted by the attack.

In contrast to most MEV-based front-running attacks that harm users who are performing the targeted transaction, JIT liquidity does not harm takers and may even benefit them. This is because takers can exchange with more liquidity than they expected, reducing slippage. However, existing LPs will see a decrease in their revenue as some of the expected fees will be redistributed to JIT LPs.

In cases like Uniswap V3, where liquidity is supplied around the current market price, takers can benefit from reduced slippage. But what benefits do LPs receive?

Firstly, LPs can supply maximum liquidity with the same amount of funds, reducing wasted liquidity. The more liquidity supplied, the larger the share of transaction fees, resulting in increased income. This drives competition to find an optimal range for liquidity supply. Another advantage is that liquidity provision enables the use of limit orders in AMMs.

For example, if a flight route from Seoul to Austin has a high demand for travelers, airlines will increase the number of flights on that route. The airlines that operate on the route with high demand will reap the benefits and earn more income as they gain a larger market share.

The downside of implementing concentrated liquidity is that makers suffer more losses due to IL. If the current price goes beyond the range where liquidity is supplied, LPs will only hold assets from the side of the token that has decreased in value. This means LPs suffer the impact of IL more quickly compared to CPMM. Setting a narrow price range exposes LPs to greater token price volatility.

If the liquidity supply range does not include the current price, the assets of the liquidity provider for the range will be composed of only one token. In this case, supplying liquidity to a very short range with a minimum price range causes the assets to transform entirely into the other token when passing through that range. Of course, unlike limit orders on centralized exchanges, the assets transform back into the original token when the price recovers, so liquidity providers need to withdraw liquidity after the liquidity is transformed into the desired token.

This possibility demonstrates the advantage of AMMs while enabling the porting of traditional financial products into the DeFi world.

Can we effectively defend against price manipulation?

If price manipulation occurs in an AMM, the on-chain price oracles that depend on it may output incorrect values. This can cause problems for DApps that rely on that value, leading to cascading failure. Common methods to minimize this risk include using Time Weighted Average Price (TWAP) or external oracles such as Chainlink.

However, assuming the same Total Value Locked (TVL), CPMM-based exchanges with concentrated liquidity are more vulnerable to price manipulation attacks than those without. When liquidity is concentrated around the current price, market manipulation requires larger funds to execute. But, the moment the concentrated liquidity dries up, the exchange moves into a less liquid zone, where larger price manipulation is possible with fewer funds, impacting the usefulness of TWAP. This can be more pronounced in liquidity pools where TVL is low, and a well-funded attacker can exploit the vulnerability of concentrated liquidity to make large profits through price manipulation.

Many market makers choose to supply liquidity around the current price to take advantage of the benefits of concentrated liquidity. Therefore, liquidity pool creators shall defend against loss of liquidity in the outer ranges by providing a certain amount of liquidity throughout the entire range.

ChainLight explores new and effective blockchain security technologies with rich practical experience and deep technical understanding. Our innovative security audits built upon such research proactively identify and eliminate various security risks and vulnerabilities in the Web3 ecosystem. To ensure continuous security even after the audit, we provide a digital asset risk management solution using on-chain data monitoring and automated vulnerability detection services.

ChainLight serves to guide and protect all users of decentralized services, lighting the way for a safer Web3 ecosystem.

• Want to see more from the ChainLight? 👉 Check out our Twitter account.

🌐 Website: chainlight.io | 📩 TG: @chainlight | 📧 [email protected]